EUVD-2025-210360
GHSA-c6cp-9jv3-vfhh
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
PR:L reflects mandatory contributor authentication; S:C captures cross-session browser impact; A:N because stored XSS does not directly impair availability of the WordPress server or plugin.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.
AnalysisAI
Stored Cross-Site Scripting in the Image Carousel WordPress plugin (versions <= 1.0.0.41) allows authenticated contributors to inject persistent malicious JavaScript into carousel elements. When a higher-privileged user such as an administrator views the affected content, the injected script executes in their browser context, enabling session hijacking or unauthorized administrative actions. No active exploitation or public exploit code has been identified at time of analysis, and the attack is bounded by the requirement for contributor-level access and victim interaction.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or output escaping of contributor-supplied input before it is rendered in HTML. The Image Carousel WordPress plugin allows users with the contributor role to embed image carousels via shortcodes or block editor fields. The vulnerability arises because one or more plugin input fields fail to properly escape user-controlled values on output, allowing raw script tags or event handler attributes to be stored and later reflected into page HTML. The CVSS scope change metric (S:C) confirms this is a stored XSS that crosses trust boundaries - payload injected by a low-privilege contributor is later executed in the higher-privilege browser context of an editor or administrator. No CPE string was provided in the available intelligence, but the affected software is the 'Image Carousel' plugin for WordPress hosted in the WordPress.org plugin repository.
RemediationAI
Update the Image Carousel WordPress plugin to the latest version available in the WordPress plugin repository - verify via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/image-carousel/vulnerability/wordpress-image-carousel-plugin-1-0-0-41-cross-site-scripting-xss-vulnerability that a patched version beyond 1.0.0.41 has been released, as an exact fix version is not confirmed in the available data. If no patch is yet available, the most effective compensating control is to deactivate the Image Carousel plugin entirely until a fix is confirmed, accepting the trade-off of losing carousel functionality. Alternatively, restrict the WordPress contributor role exclusively to fully trusted users and audit existing contributor accounts, as this closes the primary attack vector without requiring plugin removal. Enabling a Web Application Firewall (WAF) rule targeting XSS patterns - such as those offered by Patchstack, Wordfence, or Cloudflare - provides an additional layer of defense but should not be treated as a substitute for patching.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today